HIPAA and the fees for reproducing an individual's medical records may seem like old news but as recently as May 23rd, the Department of Health and Human Services (HHS) added clarification on this very topic. Since HIPAA's introduction in 1996, HHS's intent has been to provide privacy and security to protected health information (PHI) while allowing individuals affordable and easy access to their records so they have more control of their healthcare.
The Health Information and Technology for Economic and Clinical Health, or HITECH Act, is no different. It provided easier and more affordable access to records for individuals and their personal representative. Recently, some claiming to represent an individual patient are abusing portions of the newer HITECH Act in order to obtain records at a discounted rate, though this was intended only for the actual patient.
I want to change this because it's repeating what you said in the paragraph above it - "providing affordable and easy access." I don't know much about HITECH. Maybe something like: HITECH, which was created to encourage the use of EHR systems, stipulates that technology standards created under HITECH do not compromise HIPAA privacy and security laws.
Haven't seen a request like this yet? Give it time. Usually, they come from attorneys who claim to be the personal representative of an individual and want the records for potential litigation purposes. These attorneys also, at times, apply intimidation tactics, such as threatening to file a complaint with HHS if their demands are not met and they are billed according to the state statute rather than the HITECH or electronic rate.
Currently, every state has an allowable fee structure for the reproduction of medical records that is higher than the electronic rate. In Alabama a $5 search fee is permitted, $1 a page up to 25, 50 cents for every page after that, along with the actual cost of postage.
The HITECH "Right of Access" rates for patients and their personal representatives are significantly lower. This law only permits costs associated with the direct labor involved with downloading the information, a preparation of a summary or explanation, media format and postage when applicable. A practice is allowed to calculate an average cost of reproducing records or can charge a flat fee of $6.50 or less.
Does this mean that the HITECH Right of Access rates supersede Alabama's fees?
So, is an attorney a personal representative? Maybe, according to HHS. In order to qualify as a personal representative under HIPAA, one must be authorized by the individual as someone who can make a healthcare decision for that person. In the Federal Register, HHS Clarified that "an attorney of an individual may or may not be a personal representative under the rule depending on the attorney's authority to act on behalf of the individual in decisions related to healthcare." This means that a healthcare power of attorney is required for a lawyer to make these decisions. These lawyers are assuming that your business will not be familiar with the new laws and will release records based on their intimidation tactics.
Many practices also have seen an increase in third party requests with an accompanying patient's "Right of Access" request form. According to the HIPAA Privacy Rule, an individual can request their records be directed to a third party of their choosing. However, it is not considered a Right of Access request when these requests are directed by a third party.
Right of Access and HIPAA authorization forms differ greatly and have also been a source of confusion, but the main priority is to protect the patient's information from an unauthorized disclosure.
So here are some simple rules you can explain to your staff to protect your practice. If a request for records is directed by or from a third party, a HIPAA authorization form should be required. If a patient requests records to go to an attorney or insurance or any non-HIPAA entity, a HIPAA authorization should be required. If a patient would like to direct records to another HIPAA entity a Right of Access requests is sufficient.
HHS and your healthcare practice are the same. Ensure patients have easy and affordable access to their protected health information (PHI). HIPAA's Privacy Rule has permitted covered entities to disclose PHI for treatment payment and healthcare operations without the need to first obtain an individual's authorization. Now, the patient can designate Who? What? And Where? PHI is sent, for the same purposes. Nowhere in HIPAA's Privacy or Security rules or in the HITECH Act does it state that anyone other than an individual and their personal representative have the right to a lower or discounted billing rate. For additional information on this topic, search HHS with HIPAA for professionals.
Tim Greene is the regional manager and HIPAA privacy officer for Acton Corporation, a records management company based in Birmingham.